A device and incident records for reviewing notices
A device and incident records for reviewing notices
In this guide
  1. Distinguish the reports from ordinary ranking changes
  2. Confirm access and the affected property
  3. Investigate the stated issue across its scope
  4. Example: a structured-data notice
  5. Prepare a factual correction record
  6. Keep incident records separate from routine updates

Distinguish the reports from ordinary ranking changes

Manual Actions and Security Issues are different reports. Google describes the first as addressing search-policy issues and the second as covering signs of compromise or behaviour that can harm visitors. Check both when investigating an explicit notice.

If neither report contains a relevant issue, a decline in visits alone is not a reason to follow a reconsideration workflow. Return to normal investigation of queries, pages and recent changes. Keep observed report content separate from the team’s theories about why traffic moved, so a routine editorial problem is not assigned an unsupported incident label.

Confirm access and the affected property

Record the account role and property checked. With old domains or subdomains, make sure the selected property corresponds to the site under investigation. Lack of access is an unknown state, not a clean report.

Use a register containing notice type, stated scope, example URLs, review date, responsible owner and status. Open Search Console through a trusted route and compare the actual report instead of acting solely on a link in an email. Record the wording needed for the investigation without copying unnecessary private account information into shared documents.

Investigate the stated issue across its scope

Do not stop after changing only the example URL. Investigate other pages produced by the same mechanism within the stated scope. Route structured-data mismatches, user-submitted abuse and access problems to people who can change the relevant system.

A reported security issue should reach the hosting or development owner rather than becoming only a copy-editing task. Determine what investigation of public files, privileges and recurrence is needed. Preserve an appropriate incident record before removing material, while limiting access to evidence that contains sensitive information.

Records to reconcile
Records to reconcile
CheckRecordAcceptance
NoticeType, scope and example URLsVerified in the actual report
CorrectionCause, URL group and ownerShared cause addressed
VerificationPublic state and review statusRemaining work assigned
A status folder beside a security key
A status folder beside a security key

Example: a structured-data notice

In a fictional example, some software articles output ratings that are absent from the visible page and lack supporting evidence. Investigate every article using the same component, not only the example address. Record the mismatch, shared cause, affected URL group, correction and recheck result.

Do not manufacture visible ratings to justify unsupported markup. Remove data that cannot be established and compare the released markup with the page again. This is an organisational example; it is not a claim that this site received a notice or that a specific correction guarantees review acceptance.

Prepare a factual correction record

Follow the instructions for the relevant report after completing the necessary correction and checks. A review explanation should state what caused the issue, what changed and how the result was checked. Do not promise a review duration or a date when rankings will recover.

Assign an owner to monitor the report after submission. Prevention should address the identified cause through publication checks, access changes or controls on the affected input path. Avoid combining the incident with a large unrelated rewrite, because that makes the corrective evidence harder to assess.

From checks to action
From checks to actionIs an issue actually reported? → Investigate type and scope (Confirmed); Is an issue actually reported? → Return to ordinary search analysis (Incomplete); Investigate type and scope → Recheck released version (Accept); Return to ordinary search analysis → Is an issue actually reported? (After correction)ConfirmedIncompleteAcceptIs an issue actually reported?Investigate type andscopeReturn to ordinarysearch analysisRecheck released versionFrom checks to actionIs an issue actually reported? → Investigate type and scope (Confirmed); Is an issue actually reported? → Return to ordinary search analysis (Incomplete); Investigate type and scope → Recheck released version (Accept); Return to ordinary search analysis → Is an issue actually reported? (After correction)ConfirmedIncompleteAcceptIs an issueactually reported?Investigate type andscopeReturn toordinarysearchanalysisRecheck releasedversion
  • After correction:Return to ordinary search analysis → Is an issue actually reported?

Keep incident records separate from routine updates

A new SEO subscription is not required simply to read these reports. The prerequisites are appropriate property access and people who can implement the relevant changes. Separate investigation, technical correction, review and monitoring when planning costs.

Completion is not merely an apparent absence of a warning on one screen. The team should explain the corrective action, verify the public state and assign outstanding work. Keep a short reference in the ordinary editorial update register, while storing detailed incident evidence in a location limited to the people who need it.

Resources for the next step

Publishing and site improvement

Organise article planning, images, launch checks and refresh priorities as your publication grows.

Official sources

Pricing, availability and feature limits can change. Check the linked official pages before subscribing.

How we compareAdvertising disclosure